5 ms·

My dad collected some usb memory sticks from a trade show and he tried to empty them for his own use. One of the sticks he could't use: when plugged in, it sent

by anemic 12y ago

My dad collected some usb memory sticks from a trade show and he tried to empty them for his own use. One of the sticks he could't use: when plugged in, it sent keystrokes <windows key> + r + http://whatevermarketingsite.com http://whatevermarketingsite.com + enter. So it was just a dummy usb hid device that emulates a keyboard. No exploit or anything but a simple marketing gimmick that people take because of 'hey, a free usb stick!'. Here's some more info: http://blog.opensecurityresearch.com/2012/10/hacking-usb-webkeys.html http://blog.opensecurityresearch.com/2012/10/hacking-usb-web...

chiph 12y ago
A common social engineering trick is to drop some USB sticks that have keyloggers, etc. loaded on them in the employee parking area of the target firm. Sooner rather than later, someone will plug one into a corporate machine...
- eli 12y ago
  Sure, but my recollection is that depended on either Windows Autorun (which hasn't been the default for quite a while) or people being curious/foolish enough to execute a file they find on the drive. This is a lot more insidious.
  - shabble 12y ago
    IIRC a talk by Travis Goodspeed mentioned that it was only internally disabled for USB and writeable media. If a USB device presents itself as a CDROM, it can still autorun things unless globally disabled by the user. Or it could emulate a disk + HID keyboard, and enter the win+r filename.exe <RET> keystrokes necessary to launch it, or one of several other tricks. It could also intercept mass storage requests, wait til you're copying an exe onto there (even if you've reformatted the drive since), and inject a payload into it.
    - TazeTSchnitzel 12y ago
      This is how U3 drives, when they existed, were able to work. They emulated a tiny CD drive with an autorun bootstrap.
  - deleted 12y ago
    [deleted]
Havoc 12y ago
I've got one like that too. Interestingly its not an usb memory stick but rather more of an SD adapter with an actual SD card & the code isn't on the card. This one does actual work as a legit USB stick too once you get past the annoying link part.
- TeMPOraL 12y ago
  Companies that do this kind of stuff deserve to be publicly shamed and exposed as assholes.
  - pjlegato 12y ago
    Public shaming? Are you joking? The manufacturers advertise these capabilities openly! There are hundreds of them, maybe thousands, and they are in intense competition for your business. Contact a few USB stick vendors on Alibaba and see for yourself.
    - TeMPOraL 12y ago
      Just because you can, doesn't mean you should. Hijacking keyboard with something that pretends to be a pendrive is distasteful in my book.
      - pjlegato 12y ago
        I personally agree that it is distasteful. I didn't say it was tasteful. I was pointing out that your 'public shaming' suggestion would be totally ineffective as a means of addressing the problem, since the people who do these things obviously don't conform themselves to your moral schema in which suffering the reprobation of society is an undesirable outcome. They are not doing this secretly, consumed by fear and guilt, manufacturing these devices in the backroom of some disreputable bar in the nasty part of town and then furtively selling them from a van in a back alley, living in constant dread of exposure. They do this quite openly. They manufacture these things in many of the same boring factories that make the reputable brands. If you ask them, they'll cheerfully mail you some free glossy promotional material detailing fake USB drives and many other nefarious electronic things that they'll sell to anyone with a credit card, and your order will be delivered to your doorstep quite openly via FedEx or DHL. They don't care (at all, on any level) what we or anyone else think about the moral propriety of their operation, surprising though that fact may be. Indeed, a public shaming campaign would benefit them greatly as free advertising, by bringing their very existence to the attention of many new customers.
w8rbt 12y ago
I believe that some security tokens (Yubikeys) work by emulating a USB keyboard as well. http://www.yubico.com/about/intro/yubikey/ http://www.yubico.com/about/intro/yubikey/

by anemic 12y ago

chiph 12y ago

A common social engineering trick is to drop some USB sticks that have keyloggers, etc. loaded on them in the employee parking area of the target firm. Sooner rather than later, someone will plug one into a corporate machine...

eli 12y ago
Sure, but my recollection is that depended on either Windows Autorun (which hasn't been the default for quite a while) or people being curious/foolish enough to execute a file they find on the drive. This is a lot more insidious.
- shabble 12y ago
  IIRC a talk by Travis Goodspeed mentioned that it was only internally disabled for USB and writeable media. If a USB device presents itself as a CDROM, it can still autorun things unless globally disabled by the user. Or it could emulate a disk + HID keyboard, and enter the win+r filename.exe <RET> keystrokes necessary to launch it, or one of several other tricks. It could also intercept mass storage requests, wait til you're copying an exe onto there (even if you've reformatted the drive since), and inject a payload into it.
  - TazeTSchnitzel 12y ago
    This is how U3 drives, when they existed, were able to work. They emulated a tiny CD drive with an autorun bootstrap.
- deleted 12y ago
  [deleted]

Havoc 12y ago

I've got one like that too. Interestingly its not an usb memory stick but rather more of an SD adapter with an actual SD card & the code isn't on the card. This one does actual work as a legit USB stick too once you get past the annoying link part.

TeMPOraL 12y ago
Companies that do this kind of stuff deserve to be publicly shamed and exposed as assholes.
- pjlegato 12y ago
  Public shaming? Are you joking? The manufacturers advertise these capabilities openly! There are hundreds of them, maybe thousands, and they are in intense competition for your business. Contact a few USB stick vendors on Alibaba and see for yourself.
  - TeMPOraL 12y ago
    Just because you can, doesn't mean you should. Hijacking keyboard with something that pretends to be a pendrive is distasteful in my book.
    - pjlegato 12y ago
      I personally agree that it is distasteful. I didn't say it was tasteful. I was pointing out that your 'public shaming' suggestion would be totally ineffective as a means of addressing the problem, since the people who do these things obviously don't conform themselves to your moral schema in which suffering the reprobation of society is an undesirable outcome. They are not doing this secretly, consumed by fear and guilt, manufacturing these devices in the backroom of some disreputable bar in the nasty part of town and then furtively selling them from a van in a back alley, living in constant dread of exposure. They do this quite openly. They manufacture these things in many of the same boring factories that make the reputable brands. If you ask them, they'll cheerfully mail you some free glossy promotional material detailing fake USB drives and many other nefarious electronic things that they'll sell to anyone with a credit card, and your order will be delivered to your doorstep quite openly via FedEx or DHL. They don't care (at all, on any level) what we or anyone else think about the moral propriety of their operation, surprising though that fact may be. Indeed, a public shaming campaign would benefit them greatly as free advertising, by bringing their very existence to the attention of many new customers.

w8rbt 12y ago

I believe that some security tokens (Yubikeys) work by emulating a USB keyboard as well. http://www.yubico.com/about/intro/yubikey/ http://www.yubico.com/about/intro/yubikey/